Read the docs
TI-2023-22733 Aliases CVE-2023-42628GHSA-hv45-r2f5-fmhj

Cross-site scripting in Liferay DXP

Priority MEDIUM 44CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.

Why it matters now

EPSS 0.02784 86th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed com.liferay:com.liferay.wiki.web (Maven): 7.0.95com.liferay.portal:release.dxp.bom (Maven): 7.3.10.u34, 7.4.13.u88

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LiferayDXP7.0.10-de-83 and later; 7.1.10 and later; 7.2.10 and later; 7.3.10 and later; 7.4.13 – 7.4.13.u87—No fix listedCNA
LiferayPortal7.1.0 – 7.4.3.87—No fix listedCNA
—com.liferay:com.liferay.wiki.web (Maven)before 7.0.957.0.95Patch availableGHSA-hv45-r2f5-fmhj
—com.liferay.portal:release.dxp.bom (Maven)7.0.10.fp83 – 7.0.10.fp102—No fix listedGHSA-hv45-r2f5-fmhj
—com.liferay.portal:release.dxp.bom (Maven)7.1.0 – 7.1.10.fp28—No fix listedGHSA-hv45-r2f5-fmhj
—com.liferay.portal:release.dxp.bom (Maven)7.2.0 – 7.2.10.fp20—No fix listedGHSA-hv45-r2f5-fmhj
—com.liferay.portal:release.dxp.bom (Maven)7.3.0 to before 7.3.10.u347.3.10.u34Patch availableGHSA-hv45-r2f5-fmhj
—com.liferay.portal:release.dxp.bom (Maven)7.4.0 to before 7.4.13.u887.4.13.u88Patch availableGHSA-hv45-r2f5-fmhj
  • DXP VendorLiferay Affected 7.0.10-de-83 and later; 7.1.10 and later; 7.2.10 and later; 7.3.10 and later; 7.4.13 – 7.4.13.u87 Fixed in — No fix listed CNA
  • Portal VendorLiferay Affected 7.1.0 – 7.4.3.87 Fixed in — No fix listed CNA
  • com.liferay:com.liferay.wiki.web (Maven) Vendor— Affected before 7.0.95 Fixed in 7.0.95 Patch available GHSA-hv45-r2f5-fmhj
  • com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.0.10.fp83 – 7.0.10.fp102 Fixed in — No fix listed GHSA-hv45-r2f5-fmhj
  • com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.1.0 – 7.1.10.fp28 Fixed in — No fix listed GHSA-hv45-r2f5-fmhj
  • com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.2.0 – 7.2.10.fp20 Fixed in — No fix listed GHSA-hv45-r2f5-fmhj
  • com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.3.0 to before 7.3.10.u34 Fixed in 7.3.10.u34 Patch available GHSA-hv45-r2f5-fmhj
  • com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.4.0 to before 7.4.13.u88 Fixed in 7.4.13.u88 Patch available GHSA-hv45-r2f5-fmhj

CPE configurations NVD · 104

CPEVersionsRoleVendor
cpe:2.3:a:liferay:digital_experience_platform:7.0:-:*:*:*:*:*:*7.0VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_1:*:*:*:*:*:*7.0 fix_pack_1VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_10:*:*:*:*:*:*7.0 fix_pack_10VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_11:*:*:*:*:*:*7.0 fix_pack_11VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_12:*:*:*:*:*:*7.0 fix_pack_12VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_13:*:*:*:*:*:*7.0 fix_pack_13VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_14:*:*:*:*:*:*7.0 fix_pack_14VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_15:*:*:*:*:*:*7.0 fix_pack_15VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_16:*:*:*:*:*:*7.0 fix_pack_16VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_17:*:*:*:*:*:*7.0 fix_pack_17VulnerableLiferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_1:*:*:*:*:*:* Versions 7.0 fix_pack_1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_10:*:*:*:*:*:* Versions 7.0 fix_pack_10 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_11:*:*:*:*:*:* Versions 7.0 fix_pack_11 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_12:*:*:*:*:*:* Versions 7.0 fix_pack_12 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_13:*:*:*:*:*:* Versions 7.0 fix_pack_13 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_14:*:*:*:*:*:* Versions 7.0 fix_pack_14 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_15:*:*:*:*:*:* Versions 7.0 fix_pack_15 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_16:*:*:*:*:*:* Versions 7.0 fix_pack_16 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_17:*:*:*:*:*:* Versions 7.0 fix_pack_17 Vulnerable ·Liferay
Show 94 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_18:*:*:*:*:*:*7.0 fix_pack_18VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_19:*:*:*:*:*:*7.0 fix_pack_19VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_2:*:*:*:*:*:*7.0 fix_pack_2VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_20:*:*:*:*:*:*7.0 fix_pack_20VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_21:*:*:*:*:*:*7.0 fix_pack_21VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_22:*:*:*:*:*:*7.0 fix_pack_22VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_23:*:*:*:*:*:*7.0 fix_pack_23VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_24:*:*:*:*:*:*7.0 fix_pack_24VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_25:*:*:*:*:*:*7.0 fix_pack_25VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_26:*:*:*:*:*:*7.0 fix_pack_26VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_27:*:*:*:*:*:*7.0 fix_pack_27VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_28:*:*:*:*:*:*7.0 fix_pack_28VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_29:*:*:*:*:*:*7.0 fix_pack_29VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_3:*:*:*:*:*:*7.0 fix_pack_3VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_30:*:*:*:*:*:*7.0 fix_pack_30VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_31:*:*:*:*:*:*7.0 fix_pack_31VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_32:*:*:*:*:*:*7.0 fix_pack_32VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_33:*:*:*:*:*:*7.0 fix_pack_33VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_34:*:*:*:*:*:*7.0 fix_pack_34VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_35:*:*:*:*:*:*7.0 fix_pack_35VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_36:*:*:*:*:*:*7.0 fix_pack_36VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_37:*:*:*:*:*:*7.0 fix_pack_37VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_38:*:*:*:*:*:*7.0 fix_pack_38VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_39:*:*:*:*:*:*7.0 fix_pack_39VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_4:*:*:*:*:*:*7.0 fix_pack_4VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_40:*:*:*:*:*:*7.0 fix_pack_40VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_41:*:*:*:*:*:*7.0 fix_pack_41VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_42:*:*:*:*:*:*7.0 fix_pack_42VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_43:*:*:*:*:*:*7.0 fix_pack_43VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_44:*:*:*:*:*:*7.0 fix_pack_44VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_45:*:*:*:*:*:*7.0 fix_pack_45VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_46:*:*:*:*:*:*7.0 fix_pack_46VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_47:*:*:*:*:*:*7.0 fix_pack_47VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_48:*:*:*:*:*:*7.0 fix_pack_48VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_49:*:*:*:*:*:*7.0 fix_pack_49VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_5:*:*:*:*:*:*7.0 fix_pack_5VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_50:*:*:*:*:*:*7.0 fix_pack_50VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_51:*:*:*:*:*:*7.0 fix_pack_51VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_52:*:*:*:*:*:*7.0 fix_pack_52VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_53:*:*:*:*:*:*7.0 fix_pack_53VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_54:*:*:*:*:*:*7.0 fix_pack_54VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_55:*:*:*:*:*:*7.0 fix_pack_55VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_56:*:*:*:*:*:*7.0 fix_pack_56VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_57:*:*:*:*:*:*7.0 fix_pack_57VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_58:*:*:*:*:*:*7.0 fix_pack_58VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_59:*:*:*:*:*:*7.0 fix_pack_59VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_6:*:*:*:*:*:*7.0 fix_pack_6VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_60:*:*:*:*:*:*7.0 fix_pack_60VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_61:*:*:*:*:*:*7.0 fix_pack_61VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_62:*:*:*:*:*:*7.0 fix_pack_62VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_63:*:*:*:*:*:*7.0 fix_pack_63VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_64:*:*:*:*:*:*7.0 fix_pack_64VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_65:*:*:*:*:*:*7.0 fix_pack_65VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_66:*:*:*:*:*:*7.0 fix_pack_66VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_67:*:*:*:*:*:*7.0 fix_pack_67VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_68:*:*:*:*:*:*7.0 fix_pack_68VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_69:*:*:*:*:*:*7.0 fix_pack_69VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_7:*:*:*:*:*:*7.0 fix_pack_7VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_70:*:*:*:*:*:*7.0 fix_pack_70VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_71:*:*:*:*:*:*7.0 fix_pack_71VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_72:*:*:*:*:*:*7.0 fix_pack_72VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_73:*:*:*:*:*:*7.0 fix_pack_73VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_74:*:*:*:*:*:*7.0 fix_pack_74VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_75:*:*:*:*:*:*7.0 fix_pack_75VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_76:*:*:*:*:*:*7.0 fix_pack_76VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_77:*:*:*:*:*:*7.0 fix_pack_77VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_78:*:*:*:*:*:*7.0 fix_pack_78VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_79:*:*:*:*:*:*7.0 fix_pack_79VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_8:*:*:*:*:*:*7.0 fix_pack_8VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_80:*:*:*:*:*:*7.0 fix_pack_80VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_81:*:*:*:*:*:*7.0 fix_pack_81VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_82:*:*:*:*:*:*7.0 fix_pack_82VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:*7.1VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*7.2VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*7.3VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*7.4VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*7.4 update1VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:*7.4 update21VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:*7.4 update34VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:*7.4 update36VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*7.4 update41VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:*7.4 update48VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:*7.4 update50VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*7.4 update52VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:*7.4 update62VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:*7.4 update67VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*7.4 update76VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*7.4 update81VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*7.4 update82VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*7.4 update83VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*7.4 update84VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*7.4 update85VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*7.4 update86VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*7.1.0 to before 7.4.3.88VulnerableLiferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_18:*:*:*:*:*:* Versions 7.0 fix_pack_18 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_19:*:*:*:*:*:* Versions 7.0 fix_pack_19 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_2:*:*:*:*:*:* Versions 7.0 fix_pack_2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_20:*:*:*:*:*:* Versions 7.0 fix_pack_20 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_21:*:*:*:*:*:* Versions 7.0 fix_pack_21 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_22:*:*:*:*:*:* Versions 7.0 fix_pack_22 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_23:*:*:*:*:*:* Versions 7.0 fix_pack_23 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_24:*:*:*:*:*:* Versions 7.0 fix_pack_24 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_25:*:*:*:*:*:* Versions 7.0 fix_pack_25 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_26:*:*:*:*:*:* Versions 7.0 fix_pack_26 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_27:*:*:*:*:*:* Versions 7.0 fix_pack_27 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_28:*:*:*:*:*:* Versions 7.0 fix_pack_28 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_29:*:*:*:*:*:* Versions 7.0 fix_pack_29 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_3:*:*:*:*:*:* Versions 7.0 fix_pack_3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_30:*:*:*:*:*:* Versions 7.0 fix_pack_30 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_31:*:*:*:*:*:* Versions 7.0 fix_pack_31 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_32:*:*:*:*:*:* Versions 7.0 fix_pack_32 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_33:*:*:*:*:*:* Versions 7.0 fix_pack_33 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_34:*:*:*:*:*:* Versions 7.0 fix_pack_34 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_35:*:*:*:*:*:* Versions 7.0 fix_pack_35 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_36:*:*:*:*:*:* Versions 7.0 fix_pack_36 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_37:*:*:*:*:*:* Versions 7.0 fix_pack_37 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_38:*:*:*:*:*:* Versions 7.0 fix_pack_38 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_39:*:*:*:*:*:* Versions 7.0 fix_pack_39 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_4:*:*:*:*:*:* Versions 7.0 fix_pack_4 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_40:*:*:*:*:*:* Versions 7.0 fix_pack_40 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_41:*:*:*:*:*:* Versions 7.0 fix_pack_41 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_42:*:*:*:*:*:* Versions 7.0 fix_pack_42 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_43:*:*:*:*:*:* Versions 7.0 fix_pack_43 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_44:*:*:*:*:*:* Versions 7.0 fix_pack_44 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_45:*:*:*:*:*:* Versions 7.0 fix_pack_45 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_46:*:*:*:*:*:* Versions 7.0 fix_pack_46 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_47:*:*:*:*:*:* Versions 7.0 fix_pack_47 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_48:*:*:*:*:*:* Versions 7.0 fix_pack_48 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_49:*:*:*:*:*:* Versions 7.0 fix_pack_49 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_5:*:*:*:*:*:* Versions 7.0 fix_pack_5 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_50:*:*:*:*:*:* Versions 7.0 fix_pack_50 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_51:*:*:*:*:*:* Versions 7.0 fix_pack_51 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_52:*:*:*:*:*:* Versions 7.0 fix_pack_52 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_53:*:*:*:*:*:* Versions 7.0 fix_pack_53 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_54:*:*:*:*:*:* Versions 7.0 fix_pack_54 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_55:*:*:*:*:*:* Versions 7.0 fix_pack_55 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_56:*:*:*:*:*:* Versions 7.0 fix_pack_56 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_57:*:*:*:*:*:* Versions 7.0 fix_pack_57 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_58:*:*:*:*:*:* Versions 7.0 fix_pack_58 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_59:*:*:*:*:*:* Versions 7.0 fix_pack_59 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_6:*:*:*:*:*:* Versions 7.0 fix_pack_6 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_60:*:*:*:*:*:* Versions 7.0 fix_pack_60 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_61:*:*:*:*:*:* Versions 7.0 fix_pack_61 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_62:*:*:*:*:*:* Versions 7.0 fix_pack_62 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_63:*:*:*:*:*:* Versions 7.0 fix_pack_63 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_64:*:*:*:*:*:* Versions 7.0 fix_pack_64 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_65:*:*:*:*:*:* Versions 7.0 fix_pack_65 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_66:*:*:*:*:*:* Versions 7.0 fix_pack_66 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_67:*:*:*:*:*:* Versions 7.0 fix_pack_67 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_68:*:*:*:*:*:* Versions 7.0 fix_pack_68 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_69:*:*:*:*:*:* Versions 7.0 fix_pack_69 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_7:*:*:*:*:*:* Versions 7.0 fix_pack_7 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_70:*:*:*:*:*:* Versions 7.0 fix_pack_70 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_71:*:*:*:*:*:* Versions 7.0 fix_pack_71 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_72:*:*:*:*:*:* Versions 7.0 fix_pack_72 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_73:*:*:*:*:*:* Versions 7.0 fix_pack_73 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_74:*:*:*:*:*:* Versions 7.0 fix_pack_74 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_75:*:*:*:*:*:* Versions 7.0 fix_pack_75 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_76:*:*:*:*:*:* Versions 7.0 fix_pack_76 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_77:*:*:*:*:*:* Versions 7.0 fix_pack_77 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_78:*:*:*:*:*:* Versions 7.0 fix_pack_78 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_79:*:*:*:*:*:* Versions 7.0 fix_pack_79 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_8:*:*:*:*:*:* Versions 7.0 fix_pack_8 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_80:*:*:*:*:*:* Versions 7.0 fix_pack_80 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_81:*:*:*:*:*:* Versions 7.0 fix_pack_81 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_82:*:*:*:*:*:* Versions 7.0 fix_pack_82 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:* Versions 7.1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:* Versions 7.2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:* Versions 7.3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:* Versions 7.4 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:* Versions 7.4 update1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:* Versions 7.4 update21 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:* Versions 7.4 update34 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:* Versions 7.4 update36 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:* Versions 7.4 update41 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:* Versions 7.4 update48 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:* Versions 7.4 update50 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:* Versions 7.4 update52 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:* Versions 7.4 update62 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:* Versions 7.4 update67 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:* Versions 7.4 update76 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:* Versions 7.4 update81 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:* Versions 7.4 update82 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:* Versions 7.4 update83 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:* Versions 7.4 update84 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:* Versions 7.4 update85 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:* Versions 7.4 update86 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* Versions 7.1.0 to before 7.4.3.88 Vulnerable ·Liferay

Remediation

  • Fix · GHSA-hv45-r2f5-fmhj com.liferay:com.liferay.wiki.web (Maven) Fixed in 7.0.95 Advisory →
  • Fix · GHSA-hv45-r2f5-fmhj com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.3.10.u34 Advisory →
  • Fix · GHSA-hv45-r2f5-fmhj com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.4.13.u88 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-42628
  2. 2026-10-03 Alias added: GHSA-hv45-r2f5-fmhj

References

Exploit 1

Advisory 2

Other 2

  • TI-2023-22732 Cross-site scripting in Liferay DXP CVSS 3.1CRITICAL 9.6
  • TI-2022-20403 A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through… CVSS 3.1HIGH 8.8
  • TI-2025-03097 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
  • TI-2025-03169 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
  • TI-2024-17354 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
  • TI-2024-16598 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
See all 263 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences